I have a logfile with some special logs and some general logs.I want the general logs to go in a general index and the special logs(logs which match any of my grok patterns) to go in a separate index and in the general index as well. My pipeline conf looks like this: input { beats { port => "50…

Make the output to the other index conditional using something like: output { elasticsearch { hosts => [ "localhost:9200" ] index => "generallogs" } if "_grokparsefailure" not in [tags] { elasticsearch { hosts => [ "localhost:9200" ] index => "speciallogs" } } }

Discuss the Elastic Stack

Output data in multiple indices based on fields

Elastic Stack Logstash

Harsh_Verma (Harsh Verma) December 18, 2017, 9:37pm 3

Makes perfect sense. Don't know why I was not able to think about this !

Topic		Replies	Views
How to put one message to several indices by condition? Logstash	7	345	July 4, 2019
Conditional index in output Logstash	1	782	July 11, 2020
Outputting into different indices based on source Logstash	1	233	October 25, 2019
Single syslog input to multiple indices output Logstash	3	1116	July 6, 2017
How to push same document into multiple indexes? Logstash	7	3341	September 19, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Output data in multiple indices based on fields

Related topics